Splunk Search

Question about subsearch

Min1025
Explorer

Hi all,

I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?

   index=aaa sourcetype=bbb |eval errorByService=case(ErrorCode=400 AND match(uri,"/service1/*"),"service1",ErrorCode=400 AND match(uri,"/service2/*"),"service2",ErrorCode=400 AND match(uri,"/service3/*"),"service3")|stats count  as ErrorCnt by User errorByService 
|appendcols [search index=aaa sourcetype=bbb |eval totalByService=case(match(uri,"/service1/*"),"service1",match(uri,"/service2/*"),"service2", match(uri,"/service3/*"),"service3")|stats count as Total by User totalByService] |eval ErrorRate=ErrorCnt/Total |fields User, errorByService, ErrorCnt, totalByService, Total, ErrorRate

alt text

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

It is possible with ”addcoltotals” if you add a field for calculation.

(your search)
|eval Error=if(isnull(ErrorCnt),0,1)
|addcoltotals labelfield=User label=TOTAL Error

View solution in original post

0 Karma

HiroshiSatoh
Champion

It is possible with ”addcoltotals” if you add a field for calculation.

(your search)
|eval Error=if(isnull(ErrorCnt),0,1)
|addcoltotals labelfield=User label=TOTAL Error
0 Karma

Min1025
Explorer

Hi HiroshiSatoh,

Thank you for your answer. Maybe there is a ambiguity for my question. My question is if it possible the User range for subsearch is only for those user who have error.

In subsearch, it searched all Users' data, the results shows the "Total" for User1, User2...User8, but only User1,User2, User3 have error, I want to only search and show "Total" for User1,User2, User3 in subsearch, is it possible?
Expected results:
User errorByService ErrorCnt totalByService Total ErrorRate
User1 service1 2 service1 20 0.1
User2 service1 3 service1 24 0.125
User3 service2 5 service2 35 0.142857143

0 Karma

HiroshiSatoh
Champion

I'm sorry I do not understand what I want to do.

If only to extract
(your search)
|where where isnotnull(ErrorCnt)

If conditional summary ex・・・
|stats sum(eval(if(isnotnull(ErrorCnt), Total,0))) AS Total

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...